SecureVibeCoded (svc): The AI-Powered Secret Scanner Developers Would Actually Pay For

Описание и применение

SecureVibeCoded (svc) – это офлайн‑пре‑коммит‑сканер секретов, который расширяет Gitleaks машинным обучением и семантическим аудитором Gemma, снижая ложные срабатывания до 8 % и блокируя реальные ключи до публикации.

Задача

Developers frequently push sensitive credentials to public repositories, incurring high breach costs and alert fatigue.

Результат

svc reduces false positives from ~58% to ~8%, blocks leaked secrets before they reach GitHub, and offers instant remediation while keeping all source code local.

Рабочий процесс

• Install svc via pip: pip install git+https://github.com/yashselokar2025/Hacktoberfest-CommitShield.git svc install
• Configure pre‑commit hook in the repository
• Stage changes and run git commit; svc scans staged diff
• If a secret is detected, svc uses logistic regression to score the match
• For borderline cases, svc invokes Google Gemma via Ollama to audit context
• If Gemma confirms a real secret, commit is blocked and remediation is suggested
• If the secret is a false positive, commit proceeds and the finding is logged in a local SQLite baseline

Доказательства

SecureVibeCoded (svc) is an intelligent, change-aware secret scanner that sits on top of Gitleaks as a pre-commit hook.

Источник

This model achieves F1 = 0.950, reducing false positives from the raw Gitleaks baseline of ~58% down to ~8%.

Источник

Gemma runs 100% offline via Ollama — your proprietary source code never leaves your machine.

Источник